CVE-2026-119334
LowCVSS 2.2Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In Pi-hole prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes.
Risk Assessment
An administrator able to add adlists could exploit this to read root-only files, potentially exposing sensitive system data.
Recommendation
Update Pi-hole to version 6.5 or later, which fixes this issue.
Other vulnerabilities in Pi-hole
See all- CVE-2026-41489High
Pi-hole, a DNS sinkhole system, has a vulnerability in shell scripts that perform file operations with root privileges without validating paths. An attacker with Pi-hole privileges can exploit this flaw to escalate privileges to root by manipulating SSH keys.
- CVE-2026-119336High
In Pi-hole from 6.4.2 until 6.5, the root-run updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker running as pihole can replace the path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race them so chmod makes a sensitive target world-readable.
- CVE-2026-119335High
In Pi-hole prior to 6.5, getFTLPID() in utils.sh validates the pihole-owned /run/pihole-FTL.pid file with expr, rejecting only values whose first character is not a digit. An attacker with code execution as pihole can write a digit-prefixed arithmetic expression that Bash then evaluates as root, enabling command substitution execution.
- CVE-2026-50130High
A vulnerability in Pi-hole versions 6.0 to 6.4.2 allows a user with code execution as the unprivileged pihole user to escalate privileges to root by replacing the /etc/pihole/logrotate file. The file is then processed by pihole-FTL-prestart.sh, which changes its ownership to root:root, and subsequently executed as root by the daily pihole flush cron, enabling arbitrary code execution with administrative privileges.
Original NVD description (English source)
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS